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I AVE CLAIM: 

1. A method of establishing a secure Layer-3 connection across an ATM 
network, the Layer-3 connection having a first endpoint at an egress port of an 
originating multiservice switch (MSS) and a second endpoint at an ingress port 
of a terminating MSS, the method comprising the steps of: 

configuring the terminating MSS with anticipated security information; 

at the originating MSS, generating a setup message including embedded 
security information; 

sending the setup message to the terminating MSS; 

at the terminating MSS, extracting the embedded security information 
from the setup message; 

determining whether the embedded security information matches the 
anticipated security information; and 

if the embedded security information matches the anticipated security 
information, establishing the Layer-3 connection. 

2. The method of claim 1 wherein the Layer-3 connection is a Soft 
Permanent Virtual Circuit, and wherein the embedded security information and 
the anticipated security information are associated with the first endpoint. 

3. The method of claim 1 wherein the Layer-3 connection is a Soft 
Permanent Virtual Circuit, and wherein the embedded security information and 
the anticipated security information are associated with the second endpoint. 

4. The method of claim 1 wherein the embedded security information and 
the anticipated security information are Closed User Group Interlock Codes. 

5. The method of claim 1 wherein the Layer-3 connection is established by 
an originating user belonging to a configured set of originating users, and 
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wherein the embedded security information and the anticipated security 
information are associated with the configured set of originating users. 

6. The method of claim 1 wherein the Layer-3 connection is established 
through an Internet Protocol (IP) interface address at the originating MSS 
belonging to a set of configured IP interface addresses, and wherein the 
embedded security information and the anticipated security information are 
associated with the configured set of IP interface addresses. 

7. The method of claim 1 wherein the Layer-3 connection is established to a 
terminating user belonging to a configured set of terminating users, and 
wherein the embedded security information and the anticipated security 
information are associated with the configured set of terminating users. 

8. The method of claim 1 wherein the Layer-3 connection is established 
through an Internet Protocol (IP) interface address at the terminating MSS 
belonging to a set of configured IP interface addresses, and wherein the 
embedded security information and the anticipated security information are 
associated with the configured set of IP interface addresses. 

9. The method of claim 1 comprising the further steps of: 

at the originating MSS, setting a value of a flag in the setup message to 
indicate that the setup message includes embedded security information; 

at the terminating MSS, reading the value of the flag before extracting the 
embedded security information. 

10. An originating multiservice switch (MSS) for establishing a secure 
Layer-3 connection across an ATM network to a terminating MSS, comprising a 
call control for generating a Layer-3 connection setup message including 
embedded security information, and for sending the setup message to the 
terminating MSS. 

11. A computer-readable medium comprising: 
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instructions for generating a Layer-3 connection setup message to be sent 
from an originating multiservice switch (MSS) to a terminating MSS; and 

instructions for embedding security information within the setup 
message. 

12. A terminating multiservice switch (MSS) for establishing a secure 
Layer-3 connection across an ATM network from an originating MSS, 
comprising: 

stored anticipated security information; 

means for querying a comparator of two pieces of security information; 

and 

a call controller for receiving a Layer-3 connection setup message, for 
extracting embedded security information from the setup message, for querying 
the comparator to determine whether the embedded security information 
corresponds to the anticipated security information, and for establishing the 
Layer-3 connection in the event that the embedded security information 
corresponds to the anticipated security information. 

13. A computer-readable medium comprising: 

instructions for receiving a Layer-3 connection setup message received 
from an originating multiservice switch; 

instructions for extracting embedded security information from the setup 
message; 

instructions for retrieving anticipated security information; 

instructions for determining whether the embedded security information 
corresponds to the anticipated security information; and 
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instructions for establishing a Layer-3 connection in the event that the 
embedded security information corresponds to the anticipated security 
information. 
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